Whats going on....?

**TomWilko** · 23-08-2003, 07:42 PM

As i write this Zonealarm is going absolutely mental!! I cleaned out my PC of loads of rubbish earlier because the internet was running really slow. I have just re-installed Zonealarm and in the last 20mins it has blocked 700 (and rising rapidly) accesses or 'pings' to my computer.

Somebody help because this is just crazy, pages are hardly working or anything!!

**THCi** · 23-08-2003, 08:08 PM

MSBlast?

**TomWilko** · 23-08-2003, 09:46 PM

I dunno, i have posted on a couple of other forums and they said remove Zonealarm, so i have done. It seems to have settled down now, i think it was more a case of Zonealarm actually slowing m PC down with the sheer number of hits than anything else!!

**Bunjiweb** · 23-08-2003, 09:58 PM

err... WHY did u remove zonealarm???? it could be blocking MSBlast on port 135 which is very dangerous.....

It will stop...

Ben

**TomWilko** · 23-08-2003, 10:09 PM

I removed it because i was getting some 1300 hits per hour and i have had enough, i couldn't load or do nethin!

**Maldonado** · 23-08-2003, 10:16 PM

look in your processes for msblast.exe

**[GSV]Trig** · 23-08-2003, 10:30 PM

Or how about this

http://www.symantec.com/avcenter/ven...oval.tool.html

**Richie** · 23-08-2003, 11:04 PM

I doubt it very much it is MSBlast.

MSBlast floods 135 with so many requests that it causes the RPC error and shutsdown the PC within minutes.

**petrefax** · 23-08-2003, 11:33 PM

could be the latest variants of the the sobig virus - this propagates via email iirc

http://www.f-secure.com/v-descs/palyh.shtml

**Agent** · 23-08-2003, 11:53 PM

Originally posted by Richie
I doubt it very much it is MSBlast.

MSBlast floods 135 with so many requests that it causes the RPC error and shutsdown the PC within minutes.

no it doesnt

**joshwa** · 24-08-2003, 12:10 AM

it shuts down windows XP
windows 2000 just sort of carries on.

update your anti virus software and check for welchia, and ms blast with the tools from www.symantec.com

that many pings does sound bad - who are you with?

**Agent** · 24-08-2003, 01:08 AM

The MSBlast program gains root to your system via a RPC exploit, it doesnt shut down due to flooding of requests.
Once its on your machine, it issues the shutdown command, which supprisingly shuts your system down.
When you consider the damage this could of done, MSBlast is tame. It could of quite easily been set to totaly kill your HD without any problem whatsoever.

**Platinum** · 24-08-2003, 01:58 AM

I had that with Zonealarm, very slow pages loading mostly timing out, uninstalled it and now everythings ok, Done all the relevent windows updates so should be relitivly ok untill i can sort out another sutable firewall

**fondie** · 24-08-2003, 02:22 AM

Originally posted by Agent
...it doesnt shut down due to flooding of requests.
Once its on your machine, it issues the shutdown command, which supprisingly shuts your system down.

http://www.overclockers.com/tips00445/index02.asp says different

**Agent** · 24-08-2003, 02:31 AM

Strange, i read different, i dont know which is right now.
Ill go and check when i have a spare min.

**Ben Rogers** · 24-08-2003, 06:18 AM

MSBlast doesn't do anything to harm your PC and it's very easy to work around to say the least.

If you don't want to know if you have MSBlast simply goto the control pannel, administrative tools, component services then right click on remote procedure call (rpc) properties, recovery and set all three failures to 'take no action'.

Now your PC won't reboot due to the MSBlast virus, I've done this on all my 2k/xp boxes after I got the virus, not suprising really considering I don't have a firewall/antivirus, but it works a treat.

That's the best way of stopping it doing a thing without having to download crap from M$.

Thread: Whats going on....?

LinkBack

Thread Tools

Whats going on....?

Thread Information

Users Browsing this Thread

Posting Permissions